Does the repository carry the work?

The auditor defines ten boolean static domains. It counts passed predicates as evidenced domains and subtracts from ten for gaps. Hypothetically eight predicates passing gives two gaps, shown with two hundred forty and sixty pixel bars at thirty pixels per count. This is a checklist count, not eighty percent operational safety or repository correctness. Some rules look only for paths, while others search specific file strings. Test execution, independent review, truthfulness of scripts, and documentation freshness are explicitly not proven. The snapshot lacks its local JSZip engine and sample archives, so native audit controls cannot produce a computed result offline. Path semantics differ across domains. Router requires an exact root AGENTS dot md entry plus matching route and workflow-or-docs and tools-or-bin words. Runnable validation parses exact root package dot json scripts. A ZIP with a wrapping project directory can fail those exact checks even if equivalent files exist inside it. Standard workflow instead accepts any path ending with its file name. The bars compare one root filename component with a two-component wrapped path at seventy pixels each. No top-level directory normalization is implemented. Filenames and substrings provide static evidence only; their presence cannot prove the scripts execute or the claimed workflow runs. Content extraction is attempted only for certain filename extensions and uncompressed sizes at most two hundred thousand bytes. The upload control checks a twenty five million byte archive size separately. The bars show those independent limits at their stated different scales, not a relative resource-safety ratio. A compressed archive limit does not by itself bound total uncompressed data, and content exceptions are replaced with empty strings. Autofix checks a hook path and a dash dash fix substring rather than executing it; a review document mentions another model without proving independence. Preserve the original ZIP-engine failure and disabled export, then validate actual behavior separately before deployment or public completion.